Agenda and minutes

Agreed

That John Baker be appointed Chairman.

The Minutes of the meetings held on 26 March 2015 were submitted.

Re minute 4, Chair Update following meeting with Chief Executive, Members asked for a presentation on the Whistle Blowing Policy to the next meeting.

Re minute 6, Consultation on White Paper – Reforming Local Government, Members asked why Members who frequently failed to attend meetings were not replaced. Members were advised that this would be taken up with the Councils Business Manager.  

Re minute 9, Draft Annual Governance Statement, the Chief Internal Auditor reported that an IAA was an Inter Authority Agreement and in this case it was between 5 authorities (including Newport) supported by Welsh Government. The Prosiect Gwyrdd arrangement was due to start collecting waste from 1 September 2015.

Agreed

That the Minutes of the meeting held on 26 March 2015 be confirmed.

At the 26 March 2015 meeting, Audit Committee Members considered a WAO report, Accounting Statements 2013-14, which summarised WAO conclusions arising from the audit of the Council’s 2013-14 Financial Statements. This report identified issues with the Council’s Information Management and Technology control environment that should be addressed to minimise the risk of any future potential misstatements. Members raised concerns that password problems and failing to take appropriate action when staff left, were still an issue and requested that the Head of Customer Services and Digital Innovation attend the next meeting to update the committee on progress.

Members were informed that:    

•           Re the Civica – Debtors issue, a formal mechanism was now in place to notify the systems administrator of any leavers.

•           User training was no longer delivered in a live environment  

•           Access control arrangements for Logotech would be in place by the end of July 2015.

•           There was still an issue with Sims password controls and complex passwords. This issue had been raised with Capita and a response was still outstanding.

•           The procedure to remove access from leavers had already been improved. A new process was in place which involved making contact with the Oracle Financial Helpdesk and feedback.   

•           Password complexity controls had been improved and passwords were now at least eight characters and case sensitive. The 90 day turnaround to change a password had been reduced to 60 days and further improvements were being made to the process.

•           Audit logs and reports were still under review. Some systems had the facility to log every system change but this required additional processing capabilities and could be expensive to implement.

•           The Academy database access via a generic profile was only used by an administrator within IT but continued to be a problem that they were trying to deal with.

•           The issue of 70 servers using the Windows 2003 operating system had been partly addressed. By the end of July 2015 it was anticipated that only a handful of systems would remain on the old system and negotiations were underway to find a solution.

•           Plans were underway to address the IT control weaknesses in the two computer rooms. Newport Norse were providing a manual pump system and flood gate in the corridor. A bund had been constructed which was an additional measure and CCTV and extra locks had also been installed.  

•           The expiry limit on network passwords had been reduced from 90 to 60 days.

•           Co-location of both main computer rooms continued to be an issue but outside locations were being considered.   

•           Changes had been made to the way audit trails were reported.

•           There had been a lack of adequate IT Business Continuity and Disaster Recovery arrangements in place and a lot of work had been carried out over the last 12 months to put this right. This would shortly be tested in line with the Corporate Assessment. 

•           A robust back up regime was in place with  ...  view the full minutes text for item 4.

Members considered an updated version of the Corporate Risk Register. There were eight risks identified in the register, 1 high risk and 7 medium risks. Since Audit Committee last received an update in January 2015, assessments of 4 risks remained unchanged, 1 risk had increased and 3 risks had reduced.

One risk, “Delivering a Balanced Budget” was now closed following the approval of the budget by Cabinet and Council in February 2015. 

Members raised the following points:

•           The risk table in reports often identified the risk associated with not doing what was in the report rather than an analysis of doing what was in the report.

•           There was only one step in the impact matrix between “medium impact for organisation” and “catastrophic” and this could lull members into a false sense of security.   

•           There was no obvious difference in the level of importance between the top 9 risks. Surely concerns about the social services budget were more important than failing to meet Welsh Language Standards.

•           Some risks such as Safeguarding would always be a risk and Members agreed that it was important to keep them on the register so that they could continue to review the issue.

H Brayford (Project Manager) confirmed that she would take on board the observations made by the Committee

Agreed

That the contents of the Corporate Risk Register be noted.  

Members received an update on the timetable for the accounts closedown and financial statements preparation. As previously reported there had been significant staff changes and the team were currently running approximately a week behind on some tasks. Hopefully some of this time would be clawed back as there were only a few technical adjustments outstanding. Charges had been completed ahead of schedule. A working paper review had been implemented and this required significant preparation work but was well worth the time and effort and the team were still on target for completion by the end of June.

Agreed

Members noted the update.

Members considered a report upon the overall opinion on the internal controls of the City Council for 2014/15, progress against the agreed audit plan and performance against local performance indicators.

The report gave an overall opinion on the adequacy and effectiveness of the City Council’s internal controls during 2014/15 which was “Reasonable – Adequately controlled although risks identified which may compromise the overall control environment; improvements required”.  

The report also detailed the performance of the Internal Audit Section and how well its key targets in the year were met. 66% of the approved audit plan was completed in the year against a target of 75%. 

During the year, 34 reviews were undertaken, 8 received “Good” audit opinions, 21 received “Reasonable” and 5 received “Unsatisfactory” opinions. 9 Community Centre accounts were audited, 8 were unqualified and 1 qualified.  

In addition to this planned work, there were 9 special investigations undertaken in 2014/15.  These arose for a number of reasons including information straight to the section regarding allegations against a member of staff, potential fraud, theft or noncompliance with Council policy/procedures.

Despite not having a full complement of staff for the whole year, 66% of the approved audit plan was completed against a target of 75%; (73% completed in 2013/14). A total of 97 audit reviews were planned during the year with 64 being completed to at least draft stage by the end of the year.

10 jobs were included in the plan for following up previously agreed management actions. Unfortunately due to a lack of resource within the team and the prioritisation of other work, these jobs were not undertaken during the year.

Arrangements were made to fill the Senior Auditor vacancy in the team from the middle of July 2014. This post was advertised twice but applicants didn’t meet the shortlisting criteria. This post was actually vacant for the whole year as an instruction was given not to fill this post for budget saving reasons. The resource was therefore not available to complete the days allocated in the audit plan. An Auditor also left the team in January 2015 for an internal promotion. This also meant that no resource was available to undertake 50 days of allocated work within the plan. 279 productive days were spent auditing special investigations during the year, 39 days more than allocated within the plan which meant less planned work could be undertaken.

On average the planned time to undertake each audit job during 2014/15 was 12.5 days. Therefore if the resource had been available to undertake the work and the actual time spent on special investigations was within the original allocation, a total of 191 productive days could have been used to undertake planned audit work. On average this would have resulted in a further 15 jobs being undertaken; the percentage of the audit plan completed would therefore have been 81% which would have been above the target of 75%.

Getting draft reports out took 12 days against a target of 10. Final reports  ...  view the full minutes text for item 7.

Members considered a report explaining the work to be undertaken by the Internal Audit Section at an operational level for 2015/16.

It outlined where internal audit resources would be focused over the next year, covering systems and establishments in all service areas of the Council. 1343 productive audit days had been planned for 2015/16.  

The Chief Internal Auditor explained how the plan was compiled using cumulative audit knowledge and experience, corporate documents, senior management team views, the risk analysis and external audit reports along with previous history of known problems or issues. The views and concerns of service area management teams had also been incorporated into prioritising workloads for the audit planning process.

Members queried the amount of chargeable time during the year which appeared to be between 78 and 80% compared to 60% in previous years. Members requested more information regarding the efficiency of the team, were they undercharging, and how they compared with other similar size authorities. The Chief Internal Auditor agreed to pull together some information including productivity, sickness and bereavement leave in order to make a comparison.  

Agreed    

That the report be noted and that the additional information be presented to a future meeting.

Members considered a report on the use of Standing Order 24 and the Waiving of Contract Standing Orders in a recent decision taken by a Cabinet Member. Members were asked to consider whether the reasons for the urgency/waiving of contract standing orders was properly reflected in the documentation supporting the decision. The decision was “Ceasing of Winter Domestic Garden Waste Collections” where it was proposed that the service would cease from mid December 2014 to mid March 2015. Whilst the Cabinet Member had undertaken consultation with all Members prior to taking a decision, in view of the necessity to implement the action required quickly the decision was not subject to the “Call in” process under Standing Order 27.

Members discussed the risk identified in the report, “Overspending the Budget” and considered that the real risks were residents fly tipping and not meeting recycling targets. 

Agreed

That the reasons for the urgency/waiving of contract standing orders are properly reflected in the documentation supporting the decision.

Members requested a presentation on the Whistle Blowing Policy to the July meeting, a report on the outcome of the self-evaluation exercise to the September meeting and a report on the risks associated with hosting (IT) to a future meeting .

Agreed

That subject to the above, the report be noted.

There were no referrals.

Members submitted their completed self-evaluation forms and the Chief Internal Auditor agreed to compile the results and present a report to the September Audit Committee meeting.

The date of the next meeting was confirmed as 7 July 2015